https://www.exploit-db.com/exploits/25068
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200501-313

MerakMailServer是一款功能强大的邮件服务程序使用IcewarpWebMail5.3.0的MERAKMailServer7.6.0版本中的存在多个跨站点脚本漏洞。远程攻击者可以通过login.html的username参数，accountsettings_add.html的accountid参数，或者calendar.html的note、title、location字段，注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/12396/info

Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors.

Multiple cross-site scripting and HTML injection vulnerabilities affect the vulnerable software. The product is also vulnerable to a file creation with arbitrary data vulnerability. Finally it is possible for an authenticated attacker to move and read arbitrary files on an affected computer with the privileges of the affected application.

An attacker may leverage these issues to move arbitrary files with the privileges of the affected server, to carry out cross-site scripting and HTML injection attacks and to create a file with arbitrary content. These issues may lead to system wide denial of service as well as other attacks. 

http://www.example.com:32000/mail/login.html?username=[xss_here]

来源:BID
名称:12396
链接:http://www.securityfocus.com/bid/12396
来源:XF
名称:merak-icewarp-multiple-xss(19147)
链接:http://xforce.iss.net/xforce/xfdb/19147
来源:BUGTRAQ
名称:20050128MultiplevulnerabilitiesinIcewarpWebMail5.3.0:Newholes
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110693950205007&w;=2